[mgilardi]

Part 5 of the Payload plugin: a panel at the top of each collection's edit page, so a manager no longer publishes by editing a status field, watches an import as raw JSON, or decides on a proposal through the API.

What it adds

• Snapshot panel. Status in words, what the snapshot holds, its sources and licenses, and for one made from a proposal the two sealed person ids. Publish and Withdraw for a manager.
• View panel. A drawing of the saved view (first 200 nodes) with the same tree as a keyboard outline, and what readers are told. Publish waits, with the reason, until the form is saved and the snapshot is published.
• Import panel. The steps of a run, warnings and diagnostics. It looks again every 3 seconds while a job runs, and offers to run a queued, failed or interrupted job.
• Proposal panel. What the proposal would change, then Accept (naming the new version) or Decline.
• One endpoint, GET /api/<snapshots>/:id/summary: counts and capped lists, never names or trees, with the read API's 404.
• admin.panels (default on) and the @captiveorigins/payload-plugin-onetaxonomy/client entry. Hosts run payload generate:importmap after adding the plugin.

How it stays safe

• The panels have no powers of their own. They call the host's site from the browser as the signed-in person, so the host's access callbacks decide every answer. A button shown by mistake still gets the site's 403 or 404, and a refusal reads "Nothing was changed." with the reason.
• Every button asks first, in the page, and says what can't be undone. Before accepting, the panel lists what gets sealed for good and asks the manager to check it for personal details.
• A name beside a sealed id is looked up when the page loads, for signed-in requesters only, and is never stored. A visitor who may read a snapshot gets the ids alone.

Found on the way

Payload's own admin makes two requests to other sites on these pages: its JSON field loads Monaco from cdn.jsdelivr.net, and its default avatar asks gravatar.com with a hash of the signed-in person's email address. The README says so and how to turn the second off; the example site now does.

Tested

• 94 new tests: 74 render the panels in jsdom with Payload's hooks and fetch replaced by stand-ins, 11 read the installed @payloadcms/ui stylesheets and check contrast in light and dark, 9 run the summary against a real Payload with an in-memory MongoDB. 621 unit tests pass in all.
• 8 new checks over HTTP in the example site (55 in all), on the built site.
• 19 deliberate breaks, 18 caught. docs/test-audit.md says which wasn't and why.
• The snapshot, view and proposal panels were clicked through once in headless Chrome on the example site, in light and dark.

Not tested

• That browser run is not in CI.
• The import panel has not run in a real admin (the example site has no imports).
• No screen reader, Safari, Firefox, phone or custom Payload theme.
• Postgres and SQLite, as before.

Still not on npm. See ADR 0012, point 16.

🤖 Generated with Claude Code